Volkswagen discloses data breach, 3.3 million customers impacted

Volkswagen America discloses a data breach at a third-party vendor that exposed the personal details of more than 3.3 million of its customers.

Volkswagen America discloses a data breach suffered by a third-party vendor used by the car vendor for sales and marketing purposes. The security breach affected a subsidiary Audi and authorized dealers in the U.S. and Canada and exposed the personal details of more than 3.3 million Volkswagen customers, most of which were owners of Audi cars.

According to a letter sent by the company to the Maine Attorney General and reported by TechCrunch, the subsidiary company left customer data spanning 2014 to 2019 unsecured online between August 2019 and May 2021.

Volkswagen learned of the data breach on March 10 and immediately launched an investigation in the case with the help of external consultants and notified law enforcement.

“The investigation confirmed in early May 2021 that a third party obtained limited personal information received from or about United States and Canadian customers and interested buyers from a vendor used by Audi, Volkswagen, and some authorized dealers.” reported TechCrunch. “This included information gathered for sales and marketing purposes from 2014 to 2019. VWGoA believes the data was obtained when the vendor left electronic data unsecured at some point between August 2019 and May 2021, when VWGoA identified the source of the incident.”

Exposed data for over 97% of the individuals includes personal information about customers and prospective buyers, including name, personal or business mailing addresses, email addresses, and phone numbers.

For some individuals, the data also include information about a vehicle purchased, leased, or inquired about, such as the Vehicle Identification Number (VIN), make, model, year, color, and trim packages.

“For approximately 90,000 Audi customers or interested buyers, the data also includes more sensitive information relating to eligibility for a purchase, loan, or lease. Nearly all of the more sensitive data (over 95%) consists of driver’s license numbers. A very small number of records include data such as dates of birth, Social Security or social insurance numbers, account or loan numbers, and tax identification numbers.” continues the letter.

But more than 90,000 customers across the U.S. and Canada had more sensitive data exposed and for them, VWGoA is going to offer free credit protection services to these approximately 90,000 individuals through IDX.ù

At the time of this writing, it is not clear if the data exposed was misused, anyway their leak pose a risk of fraud and other malicious activities for the car owners.

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, data leak)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.